Skip to main content
mcpSource-backed
Dagu logo

Dagu MCP Server

Built-in Streamable HTTP MCP server for Dagu that lets AI agents read workflow state, inspect DAG specs and logs, preview or apply workflow changes, and start, enqueue, retry, or stop DAG runs.

by dagucloud · submitted by oktofeesh1·added 2026-06-06·
Review first review before installing

Open the source and read safety notes before installing.

Citation facts

Source-backed facts for citing this resource, derived directly from the registry — also available as plain text for AI assistants.

Source URLs
https://docs.dagu.sh/mcp/, https://github.com/dagucloud/dagu
Brand
Dagu
Brand domain
dagu.sh
Brand asset source
brandfetch
Safety notes
Dagu is a workflow engine; MCP access can expose shell commands, Docker containers, Kubernetes Jobs, SSH commands, SQL queries, HTTP calls, agent harnesses, and other workflow steps., The MCP server registers `dagu_change` and `dagu_execute` as destructive-capable tools, so require preview/review before applying DAG changes or starting/stopping production runs., API keys can be scoped to the MCP surface; avoid reusing broad admin credentials for agent access., Workflow edits may change schedules, parameters, retries, secrets usage, queues, resource limits, notifications, and downstream infrastructure actions., Keep the Dagu server and MCP endpoint behind trusted network boundaries, TLS, and authentication for shared or remote deployments.
Privacy notes
DAG specs, run parameters, logs, documents, audit records, secrets references, API keys, environment variables, and workflow outputs may be exposed to the MCP client., Workflow logs can contain credentials, customer data, internal hostnames, database query results, command output, file paths, or incident context., Dagu stores state locally by default and can also run distributed workers; review where DAG files, logs, audit entries, and secrets are persisted., Any workflow state returned through the MCP client may be sent onward to the configured model provider.
Author
dagucloud
Submitted by
oktofeesh1
Claim status
unclaimed
Last verified
2026-06-06

Decision playbook

Review trust signals before you adopt

Signals are present but mixed. Use the checklist below to confirm the source and operational safety for your environment.

Compare context
Selected

0

Current score

63

Baseline

Delta

No baseline selected

No major trust-signal divergence detected in the current selection.

Source and provenance checks

Needs review

Confirm ownership and provenance before trusting install instructions.

  • Source link availableRequired

    Open the canonical repository and verify ownership.

    Done
  • Source provenance statusRequired

    Marked as source-backed.

    Done
  • Metadata reviewed

    No reviewed flag detected in metadata.

    Pending

Safety and privacy checks

Complete

Validate risk disclosures before installation or API wiring.

  • Safety notes presentRequired

    Review the listed safety guidance before running commands.

    Done
  • Privacy notes presentRequired

    Review data handling notes before connecting accounts or secrets.

    Done
  • Trust level risk gateRequired

    Trust level does not block evaluation.

    Done

Package and install checks

Needs review

Check package metadata and artifact integrity signals.

  • Install payload available

    Install or copy payload is available for review.

    Done
  • Package verification flag

    No package verification flag provided.

    Pending
  • Checksum metadata

    No checksum provided for downloaded artifact.

    Pending

Compare-driven decision checks

Needs review

Use compare context to validate trade-offs before adoption.

  • Compare tray has multiple entries

    Add at least one more entry to compare trust differences.

    Pending
  • Baseline comparison available

    No baseline peer selected yet.

    Pending
  • Diverging trust signals identified

    No major trust-signal divergence found.

    Pending

Setup at a glance

CLI install

Copy-ready — paste the snippet to get started.

25 minutes

Adoption plan

Balanced adoption plan

Current risk score 24/100. Use staged verification before broader rollout.

Risk 24

Pre-adoption checks

Validate source and review signals before any execution.

  • Confirm source provenanceRequired

    Source URL/provenance metadata is present.

    Done
  • Confirm metadata review state

    No review metadata found; increase manual validation.

    Pending
  • Verify install payload

    Install/config payload exists and can be inspected.

    Done

Security checks

Confirm safety, privacy, and package integrity signals.

  • Review safety notesRequired

    Safety notes are present.

    Done
  • Review privacy notesRequired

    Privacy notes are present.

    Done
  • Verify package integrity metadata

    No package verification/checksum metadata.

    Pending

Rollout

Adopt in controlled steps based on the selected plan.

  • Run in isolated sandbox firstRequired

    Use a constrained sandbox and observe behavior across multiple tasks.

    Pending
  • Roll out graduallyRequired

    Roll out to a small cohort before wider usage.

    Pending
  • Set monitoring and fallback

    Define rollback path and monitor errors after adoption.

    Pending

Evidence readiness

Evidence readiness matrix · balanced

Missing required evidence: Metadata review. Risk score 31.

Risk 31

Source provenance

Present

Source repository/provenance is listed.

Required in this preset

Metadata review

Missing

Review metadata is missing.

Required in this preset

Safety notes

Present

Safety notes are present.

Required in this preset

Privacy notes

Present

Privacy notes are present.

Optional in this preset

Package integrity

Missing

Package integrity metadata is missing.

Optional in this preset

Install payload

Present

Install payload is available.

Required in this preset

Required gaps: Metadata review

Decision timeline

Decision timeline · balanced

Blocking gaps: Check metadata review status. Risk 28.

Risk 28

triage

Confirm source provenanceRequired

Source/provenance metadata is available.

Done

triage

Check metadata review statusRequired

Review metadata is missing.

Pending

verify

Review safety notesRequired

Safety notes are available.

Done

verify

Review privacy notes

Privacy notes are available.

Done

verify

Validate package integrity metadata

Package integrity metadata is missing.

Pending

rollout

Verify install payload and commandsRequired

Install payload is available.

Done

Blockers: Check metadata review status

Prerequisite readiness

Prerequisite readiness

5 prerequisites to line up before setup. Have accounts and credentials ready first.

0/5 ready
Account & credentials1Configuration1Network & hosting2General125 minutes

Safety & privacy surface

Safety & privacy surface

5 safety and 4 privacy notes across 4 risk areas. Review closely: credentials & tokens, network access, third-party handling.

4 areas
  • SafetyNetwork accessDagu is a workflow engine; MCP access can expose shell commands, Docker containers, Kubernetes Jobs, SSH commands, SQL queries, HTTP calls, agent harnesses, and other workflow steps.
  • SafetyExecution & processesThe MCP server registers `dagu_change` and `dagu_execute` as destructive-capable tools, so require preview/review before applying DAG changes or starting/stopping production runs.
  • SafetyCredentials & tokensAPI keys can be scoped to the MCP surface; avoid reusing broad admin credentials for agent access.
  • SafetyCredentials & tokensWorkflow edits may change schedules, parameters, retries, secrets usage, queues, resource limits, notifications, and downstream infrastructure actions.
  • SafetyNetwork accessKeep the Dagu server and MCP endpoint behind trusted network boundaries, TLS, and authentication for shared or remote deployments.
  • PrivacyCredentials & tokensDAG specs, run parameters, logs, documents, audit records, secrets references, API keys, environment variables, and workflow outputs may be exposed to the MCP client.
  • PrivacyCredentials & tokensWorkflow logs can contain credentials, customer data, internal hostnames, database query results, command output, file paths, or incident context.
  • PrivacyCredentials & tokensDagu stores state locally by default and can also run distributed workers; review where DAG files, logs, audit entries, and secrets are persisted.
  • PrivacyThird-party handlingAny workflow state returned through the MCP client may be sent onward to the configured model provider.

Safety notes

  • Dagu is a workflow engine; MCP access can expose shell commands, Docker containers, Kubernetes Jobs, SSH commands, SQL queries, HTTP calls, agent harnesses, and other workflow steps.
  • The MCP server registers `dagu_change` and `dagu_execute` as destructive-capable tools, so require preview/review before applying DAG changes or starting/stopping production runs.
  • API keys can be scoped to the MCP surface; avoid reusing broad admin credentials for agent access.
  • Workflow edits may change schedules, parameters, retries, secrets usage, queues, resource limits, notifications, and downstream infrastructure actions.
  • Keep the Dagu server and MCP endpoint behind trusted network boundaries, TLS, and authentication for shared or remote deployments.

Privacy notes

  • DAG specs, run parameters, logs, documents, audit records, secrets references, API keys, environment variables, and workflow outputs may be exposed to the MCP client.
  • Workflow logs can contain credentials, customer data, internal hostnames, database query results, command output, file paths, or incident context.
  • Dagu stores state locally by default and can also run distributed workers; review where DAG files, logs, audit entries, and secrets are persisted.
  • Any workflow state returned through the MCP client may be sent onward to the configured model provider.

Prerequisites

  • Dagu installed from Homebrew, GitHub Releases, npm, Docker/GHCR, Helm, or another upstream-supported installation path.
  • A running Dagu HTTP server with the built-in MCP endpoint enabled through the normal server path.
  • MCP client that supports Streamable HTTP server configuration.
  • API key with MCP surface access when Dagu authentication is enabled.
  • Existing DAG/workflow directory and policy for which agents may read, change, start, retry, stop, or enqueue workflow runs.

Schema details

Install type
cli
Troubleshooting
No
Source repository stats
Scope
Source repo
Collection metadata
Estimated setup
25 minutes
Difficulty
advanced
Full copyable content
brew install dagu

About this resource

Content

Dagu is a local-first workflow engine for defining and operating YAML DAGs with a Web UI, single-binary deployment, and no required external DBMS. Its built-in MCP server exposes a compact Streamable HTTP interface for AI agents to read Dagu state, inspect DAG specs and logs, preview or apply workflow changes, and control DAG runs.

The MCP implementation registers three core tools: dagu_read for read-only state, specs, run details, and logs; dagu_change for previewing or applying DAG YAML changes; and dagu_execute for starting, enqueueing, retrying, or stopping DAG runs.

Source Review

These sources were reviewed on 2026-06-06. Prefer the live repository, README, license notes, MCP server implementation, MCP docs, authentication docs, auditability docs, installation docs, deployment model docs, secrets docs, GitHub Releases, and GHCR package page for current setup, endpoint, tools, API key, and deployment behavior.

Features

  • Expose a built-in Streamable HTTP MCP endpoint from the running Dagu server.
  • Read DAG lists, DAG details, DAG specs, run details, run logs, and Dagu MCP reference resources.
  • Preview or apply DAG YAML changes through dagu_change.
  • Start, enqueue, retry, or stop workflow runs through dagu_execute.
  • Use resources such as current DAG specs and run logs.
  • Use prompts for creating DAGs, editing DAGs, and debugging failed runs.
  • Scope API keys to the MCP surface when Dagu authentication is enabled.
  • Keep MCP-triggered actions visible through Dagu's audit and Web UI surfaces.

Installation

Install Dagu through an upstream-supported path such as Homebrew, GitHub Releases, npm, Docker/GHCR, or Helm. For Homebrew:

brew install dagu

Start the Dagu server, enable authentication if required for your environment, and create an API key that is allowed to use the MCP surface. A sanitized MCP client configuration looks like:

{
  "mcpServers": {
    "dagu": {
      "url": "LOCAL_DAGU_MCP_URL",
      "headers": {
        "Authorization": "Bearer DAGU_MCP_API_KEY"
      }
    }
  }
}

Follow the upstream MCP clients and authentication docs for the exact local or remote endpoint, API key setup, and client-specific configuration.

Use Cases

  • Let an AI coding agent inspect workflow state and logs before editing a DAG.
  • Draft new Dagu YAML workflows from a natural-language goal, then preview validation before applying.
  • Debug failed workflow runs by reading run metadata and logs through MCP.
  • Start or enqueue approved workflow runs from Claude, Codex, Gemini CLI, or another MCP-capable agent.
  • Operate scheduled automation from a local, self-hosted, managed, or hybrid Dagu deployment.

Safety and Privacy

Dagu can run real automation, including shell commands, Docker steps, Kubernetes Jobs, SSH actions, SQL queries, HTTP requests, file operations, notifications, and AI-agent harness steps. Treat dagu_change and dagu_execute as high-impact tools. Require review before applying workflow changes, launching production jobs, retrying expensive work, stopping incident response workflows, or changing schedules and credentials.

MCP clients can see DAG specs, logs, parameters, outputs, resource references, and audit context. Review log redaction, secrets management, API key scope, and model-provider exposure before giving an agent access to sensitive workflows or customer data.

Duplicate Check

No dagucloud/dagu entry, Dagu MCP Server entry, Dagu workflow MCP entry, or matching source URL was found in content/mcp.

Source citations

Add this badge to your README

Show that Dagu MCP Server is listed on HeyClaude. Paste this Markdown into your README — it renders the badge and links back to this page.

Listed on HeyClaude
[![Listed on HeyClaude](https://heyclau.de/badge/mcp/dagu-mcp-server.svg)](https://heyclau.de/entry/mcp/dagu-mcp-server)

How it compares

Dagu MCP Server side by side with 3 alternatives on trust, install, platform support, and disclosed safety notes — all from reviewed registry metadata.

1 trust signal differ across this comparison (Submitter).

Field

Built-in Streamable HTTP MCP server for Dagu that lets AI agents read workflow state, inspect DAG specs and logs, preview or apply workflow changes, and start, enqueue, retry, or stop DAG runs.

Open dossier

Hosted Streamable HTTP MCP server for creating, inspecting, testing, publishing, unpublishing, analyzing, and styling Dreamlit notification workflows from AI clients.

Open dossier

Hosted streamable-HTTP MCP server that exposes inference.sh platform tools for running apps, managing tasks, proxying external MCP connectors, and calling hundreds of hosted AI models from Claude Code, Cursor, and other MCP clients.

Open dossier

MCP transport bridge that converts between stdio, SSE, and Streamable HTTP so local MCP clients can reach remote servers, or remote clients can reach local stdio servers.

Open dossier
Next steps
Trust
Review statusNot reviewedNot reviewedNot reviewedNot reviewed
Package trustPackage not verifiedPackage not verifiedPackage not verifiedPackage not verified
Source provenanceSource-backedSource-backedSource-backedSource-backed
SubmitterDiffersoktofeesh1oktofeesh1kiannidevoktofeesh1
Install riskReview firstReview firstReview firstReview first
Notes Safety ✓ Privacy ✓ Safety ✓ Privacy ✓ Safety ✓ Privacy ✓ Safety ✓ Privacy ✓
BrandDagu logoDaguDreamlit logoDreamlitinference.sh logoinference.sh
Categorymcpmcpmcpmcp
SourceSource-backedSource-backedSource-backedSource-backed
AuthordagucloudDreamlitinference.shSergey Parfenyuk
Added2026-06-062026-06-052026-06-222026-06-06
Platforms
Harness
Source repo
Safety notesDagu is a workflow engine; MCP access can expose shell commands, Docker containers, Kubernetes Jobs, SSH commands, SQL queries, HTTP calls, agent harnesses, and other workflow steps. The MCP server registers `dagu_change` and `dagu_execute` as destructive-capable tools, so require preview/review before applying DAG changes or starting/stopping production runs. API keys can be scoped to the MCP surface; avoid reusing broad admin credentials for agent access. Workflow edits may change schedules, parameters, retries, secrets usage, queues, resource limits, notifications, and downstream infrastructure actions. Keep the Dagu server and MCP endpoint behind trusted network boundaries, TLS, and authentication for shared or remote deployments.Dreamlit MCP is a hosted remote server at `https://mcp.dreamlit.ai/mcp`; the public repository contains setup docs and registry metadata, not the production backend source. Write scopes can create or update workflow drafts and send workflow tests; publish scopes can publish, schedule, or unpublish live notification workflows. Publishing is a separate explicit step in Dreamlit's recommended flow; keep a human confirmation gate before `confirm_publish` or `unpublish_workflow`. Use least-privilege OAuth scopes. Read-only review clients should not receive `workflows:write` or `workflows:publish`. Test important email or Slack notification drafts before publishing, especially when prompts include personalization rules, timing, timezone, or unsubscribe behavior.The hosted MCP server can execute inference.sh apps, platform tasks, and proxied connector tools that may create, update, or delete data in connected services such as GitHub, Linear, Slack, Notion, or databases. Bearer API keys grant account-scoped access to platform capabilities; rotate compromised keys immediately and avoid committing tokens to repositories or shared MCP config files. MCP proxy features can discover and call tools on remote MCP servers through inference.sh, which expands the runtime trust boundary beyond the primary client configuration. Tool calls may trigger paid inference, connector actions, storage writes, or outbound network requests according to the selected app or connector. Use least-privilege connector authorization and review each proxied server before enabling it in production agent workflows.mcp-proxy can expose local stdio MCP servers as network services; keep the host bound to `127.0.0.1` unless remote access is intentional. Passing `--host=0.0.0.0`, permissive CORS, or named-server routes can make tools reachable by other systems on the network. Proxy configuration can include bearer tokens, OAuth client secrets, headers, server commands, environment variables, and working directories. The proxy can spawn arbitrary configured MCP server commands; only use trusted command strings and config files. Remote SSE or Streamable HTTP servers should be authenticated and trusted before forwarding client requests or tool outputs.
Privacy notesDAG specs, run parameters, logs, documents, audit records, secrets references, API keys, environment variables, and workflow outputs may be exposed to the MCP client. Workflow logs can contain credentials, customer data, internal hostnames, database query results, command output, file paths, or incident context. Dagu stores state locally by default and can also run distributed workers; review where DAG files, logs, audit entries, and secrets are persisted. Any workflow state returned through the MCP client may be sent onward to the configured model provider.Dreamlit MCP can expose workflow metadata, saved brand kit summaries, connected project context, preview or builder URLs, and bounded notification analytics. Analytics access can reveal recipient engagement and workflow run data; filter narrowly and paginate instead of requesting broad reporting dumps. Do not paste database credentials, raw secrets, private tokens, or integration credentials into prompts or shared MCP configs. Review Dreamlit, MCP client, AI-provider, and downstream-tool retention policies before using real customer, recipient, or workspace data.Prompts, files, tool arguments, task metadata, connector payloads, and model outputs are processed by inference.sh and may transit connected third-party MCP services. OAuth-backed connectors can expose account, workspace, issue, message, or repository content to the agent through proxied tool results. API keys, connector tokens, and task logs should be treated as sensitive credentials and kept out of version control and public issue threads. Hosted execution may retain usage, billing, and operational telemetry according to inference.sh policies; review the platform privacy documentation before processing regulated data.MCP requests, responses, tool outputs, progress events, headers, OAuth tokens, API access tokens, and session identifiers may pass through the proxy process. Named server config files can contain command arguments, environment variables, and credentials for downstream MCP servers. Exposed network endpoints can reveal tool names, server status, and results to clients that can reach the proxy. Logs and troubleshooting output may include endpoint URLs, command names, headers, connection errors, or server names. Store config files outside shared repositories when they include tokens or private server details.
Prerequisites
  • Dagu installed from Homebrew, GitHub Releases, npm, Docker/GHCR, Helm, or another upstream-supported installation path.
  • A running Dagu HTTP server with the built-in MCP endpoint enabled through the normal server path.
  • MCP client that supports Streamable HTTP server configuration.
  • API key with MCP surface access when Dagu authentication is enabled.
  • Dreamlit workspace and project access for the notification workflows being managed.
  • MCP client that supports remote Streamable HTTP servers and Dreamlit OAuth, or a client path that can use Dreamlit personal access tokens.
  • Workspace decision on which scopes to grant, such as `workflows:read`, `workflows:write`, `workflows:publish`, and `analytics:read`.
  • Human review process for workflow tests, publishing, scheduling, and unpublishing actions.
  • An inference.sh account and API key from `belt login` or the platform dashboard.
  • An MCP client that supports streamable HTTP transport, such as Claude Code, Cursor, Cline, or Windsurf.
  • Review of which inference.sh apps, connectors, and proxy tools the agent may call before enabling write-capable workflows.
  • A billing and quota plan if the workflow will run image, video, LLM, search, or connector-backed tasks at scale.
  • Python 3.10 or newer.
  • uv, pipx, or Docker for installation.
  • A known MCP endpoint or local stdio MCP server to bridge.
  • Review of required headers, OAuth client credentials, CORS origins, host, port, and named-server configuration.
Install
brew install dagu
codex mcp add dreamlit --url https://mcp.dreamlit.ai/mcp && codex mcp login dreamlit
Run `belt login` to create an inference.sh API key, then add the streamable HTTP MCP endpoint `https://api.inference.sh/mcp` with `Authorization: Bearer inf_<your_api_key>` in your MCP client settings.
uv tool install mcp-proxy
Config
{
  "mcpServers": {
    "dagu": {
      "url": "LOCAL_DAGU_MCP_URL",
      "headers": {
        "Authorization": "Bearer DAGU_MCP_API_KEY"
      }
    }
  }
}
{
  "mcpServers": {
    "dreamlit": {
      "url": "https://mcp.dreamlit.ai/mcp",
      "type": "http"
    }
  }
}
{
  "mcpServers": {
    "inference": {
      "type": "streamable-http",
      "url": "https://api.inference.sh/mcp",
      "headers": {
        "Authorization": "Bearer inf_your_api_key"
      }
    }
  }
}
Manual-only setup:
mcp-proxy https://example.com/sse
Citations
ClaimUnclaimedUnclaimedUnclaimedUnclaimed
Open 4 picks in the interactive comparison tool

Related guides

Signals

Loading live community signals…

More like this, weekly

A short, calm digest of reviewed Claude resources. Unsubscribe any time.